CVE-2025-44251

Executive Summary

CVE-2025-44251 exposes a critical security flaw in the Ecovacs Deebot T10 robot vacuum (firmware version 1.7.2). During the initial Wi-Fi pairing process, the device transmits the home Wi-Fi network credentials (SSID and password) in cleartext over the air. This vulnerability allows an attacker within radio range to passively sniff the wireless traffic and capture the credentials, leading to unauthorized network access and potential lateral movement within the victim's home network.

The vulnerability is rooted in the lack of encryption during the device's provisioning phase. The Deebot T10 uses a direct Wi-Fi connection (soft AP) or Bluetooth for initial setup, but the actual credential exchange occurs over an unencrypted channel. This is a classic case of CWE-319: Cleartext Transmission of Sensitive Information.

Supply Chain & Package Security

This vulnerability is not related to any software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in an IoT device. The risk is primarily to end-users and their home network security, not to software supply chains.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – The attacker must be within Wi-Fi range of the Deebot T10 during the pairing process.
• Attack Complexity (AC): Low (AC:L) – Standard Wi-Fi sniffing tools are sufficient.
• Privileges Required (PR): None (PR:N) – No prior authentication is needed.
• User Interaction (UI): None (UI:N) – The victim only needs to perform the normal pairing process.
• Scope (S): Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality (C): High (C:H) – Wi-Fi credentials are fully exposed.
• Integrity (I): None (I:N) – Credentials are not modified.
• Availability (A): None (A:N) – No impact on availability.

CVSS Score: 6.5 (Medium) – The score is medium due to the requirement of physical proximity, but the impact on home network security is high.

Deep Dive & Mechanics

The Ecovacs Deebot T10 uses a standard IoT provisioning flow:

1. The user places the robot in pairing mode (e.g., pressing a button).
2. The robot creates a temporary Wi-Fi access point (soft AP) or uses Bluetooth Low Energy (BLE) for initial communication.
3. The user's mobile app connects to this temporary network.
4. The app sends the home Wi-Fi SSID and password to the robot.
5. The robot disconnects from the temporary network and connects to the home Wi-Fi.

The Flaw: In firmware version 1.7.2, step 4 is performed over an unencrypted HTTP connection or a custom protocol that does not use TLS. An attacker with a Wi-Fi sniffer (e.g., Wireshark, airodump-ng) can capture the entire handshake and extract the credentials in plaintext.

Technical Detail: The robot likely listens on a specific TCP port (e.g., 80 or 8080) during the pairing phase. The mobile app sends a POST request with the credentials in JSON or XML format. Example captured packet:

POST /config/wifi HTTP/1.1
Host: 192.168.4.1
Content-Type: application/json
Content-Length: 78

{"ssid":"MyHomeWiFi","password":"SuperSecret123"}

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.7.2):

# Pseudocode for the vulnerable pairing server
def handle_pairing_request(request):
    ssid = request.get('ssid')
    password = request.get('password')
    # No encryption - sends credentials in cleartext
    connect_to_wifi(ssid, password)

Patched Code (Hypothetical):

# Pseudocode for a secure pairing server
import ssl

def handle_pairing_request(request):
    # Use TLS to encrypt the communication
    if not request.is_secure():
        return "Error: Secure connection required"
    ssid = decrypt(request.get('ssid'))
    password = decrypt(request.get('password'))
    connect_to_wifi(ssid, password)

The fix would involve implementing TLS on the temporary AP's web server or using a secure key exchange protocol (e.g., WPS PIN or Diffie-Hellman).

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• A laptop with Kali Linux or any Linux distribution.
• A wireless adapter that supports monitor mode (e.g., Alfa AWUS036ACH).
• Wireshark or tcpdump for packet capture.
• A Deebot T10 robot in pairing mode.

Steps:

1. Enable monitor mode on the wireless interface:

   sudo airmon-ng start wlan0
   

2. Scan for the Deebot's temporary AP (SSID usually starts with "Deebot_"):

   sudo airodump-ng wlan0mon
   

3. Once identified, capture traffic on that specific channel:

   sudo airodump-ng -c <channel> --bssid <MAC> -w capture wlan0mon
   

4. Wait for the victim to pair the robot. The credentials will appear in the capture file.
5. Extract the credentials using Wireshark filter: http.request.method == "POST" or by searching for "ssid" in the raw data.

Alternative Method (Passive Sniffing): If the robot uses a custom protocol, use a tool like bettercap to perform a man-in-the-middle attack on the temporary AP.

Blue Team (Defender)

Detection:

• Monitor for unusual Wi-Fi probe requests or deauthentication packets near the Deebot.
• Use a network intrusion detection system (NIDS) to alert on cleartext credential transmission.
• Implement Wi-Fi Protected Access 3 (WPA3) which provides stronger encryption for the home network.

Mitigation:

• Disable the robot's Wi-Fi when not in use.
• Use a separate IoT VLAN to isolate the robot from critical devices.
• Apply a firmware update as soon as it becomes available.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Unencrypted HTTP POST requests to IP 192.168.4.1 (or similar) containing "ssid" and "password" fields.
  • Presence of a temporary Wi-Fi AP with SSID starting with "Deebot_" and no encryption.
• File Hashes (Firmware):
  • Firmware version 1.7.2: SHA256 hash a1b2c3d4e5f6... (placeholder, actual hash would be provided by vendor).
• MAC Addresses:
  • Deebot T10 MAC prefix: 00:1A:2B (example, actual OUI is EC:FA:BC for Ecovacs).

Detection Engineering

YARA Rule

rule CVE_2025_44251_Cleartext_Credentials {
    meta:
        description = "Detects cleartext Wi-Fi credentials in network traffic from Ecovacs Deebot T10"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-44251"
    strings:
        $ssid = /"ssid"\s*:\s*"[^"]+"/ nocase
        $password = /"password"\s*:\s*"[^"]+"/ nocase
        $deebot = "Deebot" nocase
    condition:
        all of ($ssid, $password) and $deebot
}

Sigma Rule

title: Cleartext Wi-Fi Credentials from Ecovacs Deebot T10
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unencrypted transmission of Wi-Fi credentials during Deebot T10 pairing
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-44251
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 3
        DestinationPort: 80
        DestinationIp: 192.168.4.1
        Image: '*\Ecovacs\*'
    condition: selection
falsepositives:
    - Legitimate pairing process (but still a vulnerability)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET 80 (msg:"CVE-2025-44251 Ecovacs Deebot T10 Cleartext Credentials"; flow:to_server; content:"POST"; http_method; content:"/config/wifi"; http_uri; content:"ssid"; http_client_body; content:"password"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Wi-Fi Pairing: If the robot is already configured, do not re-pair it. Disable the Wi-Fi setup mode via the physical button.
2. Use a Guest Network: Place the Deebot on a separate IoT VLAN or guest network to limit lateral movement.
3. Monitor Network Traffic: Use the provided detection rules to identify any ongoing exploitation attempts.

Long-Term Fix:

• Vendor Action: Ecovacs must release a firmware update that encrypts the credential exchange using TLS or a secure key agreement protocol.
• User Action: Apply the firmware update as soon as it is available. Check the Ecovacs support website regularly.

Workaround:

• Use a secondary router with WPA3-Enterprise or a VPN for the IoT network.
• Manually configure the robot using an SD card or USB (if supported) to avoid over-the-air credential transmission.

Valters IT